122 matches found
Microsoft ASP.NET Version Detection
Binary data 4129.prm...
Filtering / protection bypass in Microsoft ASP.NET
There are multiple ways to bypass filtering functions and conduct crossite scripting attack...
Microsoft ASP.NET AutoPostBack变量跨站脚本漏洞（MS06-056）
ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 ASP.Net Framework 2.0的服务器中存在一个跨站点脚本执行漏洞，可能在用户的浏览器中注入客户端脚本，该脚本可能欺骗内容、泄露信息或执行用户可以在受影响的网站上执行的任何操作。要试图利用此漏洞，需要进行用户交互。 Microsoft ASP.NET 2.0 Microsoft已经为此发布了一个安全公告（MS06-056）以及相应补丁: MS06-056：Vulnerability in ASP.NET 2.0 Could Allow Information Disclosure 922770...
Microsoft ASP.NET AutoPostBack Variable Cross-Site Scripting Vulnerability
Description Microsoft ASP.NET is prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input before it is rendered in the browser of an unsuspecting user in the context of the affected site. An attacker may leverage this issue to have arbitrar...
CVE-2005-2224
aspnetwp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service CPU consumption from infinite loop via a crafted SOAP message to an RPC/Encoded method...
CVE-2005-2224
The CVE-2005-2224 entry concerns Microsoft ASP.NET web services, where aspnet_wp.exe is affected by processing crafted SOAP messages sent to an RPC/Encoded method, leading to denial of service via CPU consumption from an infinite loop. The available connected documents confirm the affected compon...
CVE-2005-1665
The VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service CPU consumption via deeply nested markup...
CVE-2005-1664
The VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to 1 apply a ViewState generated from one view to a different view, 2 reuse ViewState information after the application's state has changed, or 3 use the ViewState to conduct attacks or expose...
CVE-2005-1665
The VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service CPU consumption via deeply nested markup...
CVE-2005-0452
Multiple cross-site scripting XSS vulnerabilities in Microsoft ASP.NET .Net 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including "" and ""...
CVE-2005-0452
Multiple cross-site scripting XSS vulnerabilities in Microsoft ASP.NET .Net 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including "" and ""...
Microsoft ASP.NET directory traversal
It's possible to traverse directory...
Microsoft ASP.NET fails to perform proper canonicalization
Overview Microsoft ASP.NET contains a canonicalization vulnerability that may allow a remote unauthenticated attacker to gain access to secure contents. Description Microsoft ASP.NET is a programming framework for creating web applications. The canonicalization routine used by ASP.NET fails to...
CVE-2004-0847
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a 1 "" backslash or 2 "%5C" encoded backslash, aka "Path Validation Vulnerability."...
Microsoft ASP.NET 1.x - URI Canonicalization Unauthorized Web Access
source: https://www.securityfocus.com/bid/11342/info Microsoft ASP.NET is reported prone to a remote information-disclosure vulnerability because the application fails to properly secure documents when handling malformed URI requests. An attacker may leverage this issue to bypass authentication...
Microsoft ASP.NET 1.x - URI Canonicalization Unauthorized Web Access
Microsoft ASP.NET 1.x - URI Canonicalization Unauthorized Web Access source: https://www.securityfocus.com/bid/11342/info Microsoft ASP.NET is reported prone to a remote information-disclosure vulnerability because the application fails to properly secure documents when handling malformed URI...
Multiple vendor SOAP server (XML parser) denial of service (DTD parameter entities)
/////////////////////////////////////////////////////////////////////////////// //========================== Security Advisory ==========================// ///////////////////////////////////////////////////////////////////////////////...
Multiple Vendor SOAP server (XML parser) attribute blowup DoS
/////////////////////////////////////////////////////////////////////////////// //========================== Security Advisory ==========================// ///////////////////////////////////////////////////////////////////////////////...